5 ms·

I'm curious how many people run RoR on OBSD web servers. I suspect it exists, but very rarely

by SEJeff 14y ago

protomyth 14y ago
I did for a while, but as the patch suggests, it is probably a better idea just to install using gem. There is really no need to have rails in the ports as it doesn't require any special compilation to run on OpenBSD.
- jzwinck 14y ago
  Ironic to see this suggestion when this post is immediately below one on the front page saying rubygems are not safe to install. It would be too bad if the security savvy BSD folks pushed their users into a worse situation by using gem.
  - jonknee 14y ago
    The situation currently is an unmaintained and guaranteed insecure package, so I don't think having users rely on something else will make it worse. > These ports haven't been maintained and have been subject to numerous security issues over the past couple years (including a very critical one that made the news this week)
  - PommeDeTerre 14y ago
    Removing some insecure and/or untrustworthy code in no way forces any OpenBSD user to use other insecure and/or untrustworthy code. I suspect that most responsible OpenBSD users with Ruby or Ruby on Rails code would likely already be looking at non-Ruby alternatives.
  - byroot 14y ago
    It's not the role of OpenBSD or any other distribution to provide those gems. I don't know anyone that rely on system packaging to get gems or eggs or CPAN module. And it would be silly because you can't run an arbitrary ruby/python app with and arbitrary version of gems. And IHMO Debian should take the same decision and stop packaging gems and eggs.
  - protomyth 14y ago
    Well, I would expect the OpenBSD folks to think that the Rails folks will eventually get it together or die off. I would also imagine, given it takes no special code to run Rails on OpenBSD, that they feel the Rails folks have more resources to push out releases and OpenBSD folks shouldn't wait on a port.
static_typed 14y ago
We did. Until a few days ago. IT Security pulled the apps after the recent critical vulns in Rails, and now this vuln with RubyGems. Still using OpenBSD for hosting, but the apps are being ported to PHP and Python as we speak.
- rjbond3rd 14y ago
  Whoa, could you elaborate? I'm sure people would love to hear more context for totally rewriting (not second-guessing, just intensely curious).
  - static_typed 14y ago
    Sure. We had a number of Rails apps running in our production environment. The recent weeks have been a very stressful time. A critical Rails or Ruby related vuln is discovered, and then we have to make emergency changes to try avoid the app or server getting compromised. Of course, given the large number of these critical issues, the business decided to pull and rewrite the apps based on input from the It Security team who described the current Ruby developer culture as being immature, ignorant of software engineering principles, unaware of secure coding, too enamoured with shiny/magic/convenience to care about longer-term implications in their design choices, thinking that constant band-aid fixes are the right way forward rather than acknowledge and fix poor design and implementation, and basically a liability for the company and it's data.
    - eric970 14y ago
      Dude, every one of your posts on HN I've seen has been about how Ruby sucks and should be thrown away. Either you're a troll or you're a very angry and upset person. Either way, I feel sorry for you.
      - PommeDeTerre 14y ago
        I don't mean you any offense, but your response is the kind that makes the entire Ruby community look very bad. It is perfectly normal for responsible software developers, system administrators and business leaders to get angry or upset by security vulnerabilities. The impact such vulnerabilities can have on an organization is staggering. When they're exploited, there can be huge sums of money lost. There can be serious legal ramifications. A company's reputation can be destroyed by a single incident. And those are just a few of the consequences. Even when these vulnerabilities aren't exploited, there are still significant costs associated with fixing them, testing such fixes, deploying the fixes, and so forth. Software is supposed to bring benefits to its users, not problems and costs. Costly problems with software will make many people angry. Ruby, Ruby on Rails and some related software have had a very bad time lately. They have caused a lot of problems for a lot of people, and this has indeed resulted in anger and wasted monkey. Some people are making a sensible decision to look toward alternative technologies, to try to minimize their losses. Instead of labeling such people as "trolls", the Ruby community as a whole needs to engage in some significant self-evaluation. Try to understand why people are expressing what they are, and perhaps even try to learn from what they're saying. Security is important, and the Ruby community needs to learn this fact.

I'm curious how many people run RoR on OBSD web servers. I suspect it exists, but very rarely

by SEJeff 14y ago

I'm curious how many people run RoR on OBSD web servers. I suspect it exists, but very rarely

I did for a while, but as the patch suggests, it is probably a better idea just to install using gem. There is really no need to have rails in the ports as it doesn't require any special compilation to run on OpenBSD.

jzwinck 14y ago
Ironic to see this suggestion when this post is immediately below one on the front page saying rubygems are not safe to install. It would be too bad if the security savvy BSD folks pushed their users into a worse situation by using gem.
- jonknee 14y ago
  The situation currently is an unmaintained and guaranteed insecure package, so I don't think having users rely on something else will make it worse. > These ports haven't been maintained and have been subject to numerous security issues over the past couple years (including a very critical one that made the news this week)
- PommeDeTerre 14y ago
  Removing some insecure and/or untrustworthy code in no way forces any OpenBSD user to use other insecure and/or untrustworthy code. I suspect that most responsible OpenBSD users with Ruby or Ruby on Rails code would likely already be looking at non-Ruby alternatives.
- byroot 14y ago
  It's not the role of OpenBSD or any other distribution to provide those gems. I don't know anyone that rely on system packaging to get gems or eggs or CPAN module. And it would be silly because you can't run an arbitrary ruby/python app with and arbitrary version of gems. And IHMO Debian should take the same decision and stop packaging gems and eggs.
- protomyth 14y ago
  Well, I would expect the OpenBSD folks to think that the Rails folks will eventually get it together or die off. I would also imagine, given it takes no special code to run Rails on OpenBSD, that they feel the Rails folks have more resources to push out releases and OpenBSD folks shouldn't wait on a port.

static_typed 14y ago

We did. Until a few days ago. IT Security pulled the apps after the recent critical vulns in Rails, and now this vuln with RubyGems. Still using OpenBSD for hosting, but the apps are being ported to PHP and Python as we speak.

rjbond3rd 14y ago
Whoa, could you elaborate? I'm sure people would love to hear more context for totally rewriting (not second-guessing, just intensely curious).
- static_typed 14y ago
  Sure. We had a number of Rails apps running in our production environment. The recent weeks have been a very stressful time. A critical Rails or Ruby related vuln is discovered, and then we have to make emergency changes to try avoid the app or server getting compromised. Of course, given the large number of these critical issues, the business decided to pull and rewrite the apps based on input from the It Security team who described the current Ruby developer culture as being immature, ignorant of software engineering principles, unaware of secure coding, too enamoured with shiny/magic/convenience to care about longer-term implications in their design choices, thinking that constant band-aid fixes are the right way forward rather than acknowledge and fix poor design and implementation, and basically a liability for the company and it's data.
  - eric970 14y ago
    Dude, every one of your posts on HN I've seen has been about how Ruby sucks and should be thrown away. Either you're a troll or you're a very angry and upset person. Either way, I feel sorry for you.
    - PommeDeTerre 14y ago
      I don't mean you any offense, but your response is the kind that makes the entire Ruby community look very bad. It is perfectly normal for responsible software developers, system administrators and business leaders to get angry or upset by security vulnerabilities. The impact such vulnerabilities can have on an organization is staggering. When they're exploited, there can be huge sums of money lost. There can be serious legal ramifications. A company's reputation can be destroyed by a single incident. And those are just a few of the consequences. Even when these vulnerabilities aren't exploited, there are still significant costs associated with fixing them, testing such fixes, deploying the fixes, and so forth. Software is supposed to bring benefits to its users, not problems and costs. Costly problems with software will make many people angry. Ruby, Ruby on Rails and some related software have had a very bad time lately. They have caused a lot of problems for a lot of people, and this has indeed resulted in anger and wasted monkey. Some people are making a sensible decision to look toward alternative technologies, to try to minimize their losses. Instead of labeling such people as "trolls", the Ruby community as a whole needs to engage in some significant self-evaluation. Try to understand why people are expressing what they are, and perhaps even try to learn from what they're saying. Security is important, and the Ruby community needs to learn this fact.